LAUNCH RISK ACCEPTABILITY: THE PUBLIC SPEAKS 

Jerold M. Haber (1) , Richard W. Lamoreaux (2) 

(!) Acta, Inc., 2790 Dr., Suite 310, Torrance, CA, 90505, USA, Email: haber@actainc.com 
(2) NASA, Mail Code SA-G1, Kennedy Space Center, FL, 32899, USA, Email: richard.w.lamoreaux@nasa.gov : 


ABSTRACT 

The perspective of those assuming risk has become 
increasingly important to launch agencies. The IAASS 
white paper “An ICAO for Space?” proposed four 
ultimate goals of any international regulatory 
framework. The first of these was to 

“Ensure that citizens of all nations are equally 
protected from “unreasonable levels” of risk 
from over flight by missiles , launch vehicles 
and returning spacecraft” 

A key component of this concept is the issue of what is 
an “unreasonable level” of risk from the perspective of 
those assuming the risk. 

1. BACKGROUND 

The IAASS Working Group on “An ICAO for Space?” 
defined a number of launch and reentry safety issues. 
At present, each nation with space access capability and 
weapons testing needs determines independently what 
risk limits to other nations are acceptable. Risk 
measures vary significantly as do the space faring 
nations’ criteria for acceptability. Moreover, risk 
acceptability is determined on a per launch basis. The 
concerns of the risk receiving parties are not directly 
addressed; risks to major foreign cities and countries are 
typically not part of the launch acceptability decisions in 
some countries. 

In addition, no attempt is made to assess the overall 
annual risk to all parties from all launches and returning 
spacecraft flown by all space faring nations, let alone to 
obtain their informed consent to being subjected to such 
risks. If there is to be informed consent several 
important questions must be addressed: 

What adverse outcomes are we measuring when we 
refer to risk? Quantification of risks is inconsistent 
among space faring nations. Some only quantify risks 
from planned jettisons while others perform 
comprehensive analyses to include malfunction 
scenarios. Many limit their analyses to inert debris; a 
few address inert and explosive debris, firebrands, and 
toxic emissions. Many protect against fatalities while 
neglecting lesser injuries 

What risk measures should be used to assure protection 
against unreasonable levels of risk? A number of 
different risk measures have been used to protect the 
public. Some of these are designed to protect the 


maximally exposed individual, several are designed to 
protect against societal risk, still others are designed to 
protect assets or protect the public against large (many 
simultaneous injuries or large economic effects) losses. 

What constitutes unreasonable levels of risk? U.S. 
studies have suggested that the tolerability of a given 
risk level is related to both the benefit derived by the 
risk taker and whether the risk is voluntary. If, as we 
have suggested, some measure of annual risk is the 
appropriate measure, some approach is needed to 
address the variation in benefits afforded to the affected 
parties. 

2. RISK COMMUNICATION 

U.S. National Ranges establish and implement 
processes that assure public and worker risk levels 
associated with launch operations are reviewed and 
approved at a proper authority level. Each Range or 
Launch Program normally assigns the responsibility of 
formally accepting and assuming liability for risk to the 
public and workforce to a specific individual. At most 
U.S. Department of Defense (DoD) ranges, this 
responsibility is assigned to the Range Commander. 
Other non DoD ranges may assign this responsibility to 
a Launching Agency (especially when flying under an 
FAA license) or the Facility Director. The generic term; 
“decision maker” will be used in this paper to describe 
this important position. The decision maker may be a 
civilian leader or member of the armed forces, and is 
ultimately responsible for accepting or rejecting risk 
associated with operations performed in their cognizant 
areas 

To help fulfill this responsibility, organizations 
normally establish and maintain a Range Safety Office. 
This office works closely with the launch vehicle and 
payload communities, establishes and implements range 
safety policy and requirements, and advises the decision 
maker on matters associated with range safety risk. To 
help in maintaining consistent requirements and 
policies, and to establish a forum where multiple ranges 
can discuss and develop common solutions to technical 
issues, many US ranges participate as members of the 
Range Commanders Council (RCC). This organization 
has representation from all agencies of the US DoD, 
including the Air Force, Army, Navy, NASA and the 
FAA. Among other responsibilities, the RCC is tasked 
with developing and maintaining commonality 
standards on range safety topics such as flight 
termination systems, risk criteria, unmanned air 
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vehicles, global positioning, and inertial measurements 
tracking. Most ranges consider these standards the basis 
for locally established range safety requirements, 
including acceptable risk criteria. 

The Federal Aviation Administration (FAA) regulates 
public safety of commercially licensed launches within 
the U.S., and U.S. entities launching somewhere other 
than a U.S. range Since most US commercial launches 
take place at federal ranges, the FAA and US ranges 
have teamed to develop common range safety standards. 
These common standards help to streamline approval of 
operations by avoiding over regulation and duplication, 
and sometimes confliction of requirements. The FAA 
also performed baseline assessments of various federal 
launch ranges to assess the adequacy of the range 
services. These evaluations resulted in defining federal 
launch ranges for which a launch applicant did not need 
to demonstrate the adequacy of the range services. 

Due to the nature, complexity, and sometimes the 
classification of DoD or large government activities, the 
federal range decision maker is usually granted ultimate 
responsibility for accepting range safety risk associated 
with government launches or landings. The decision 
maker is not required to obtain public or representative 
approval when accepting elevated risk for areas within 
or exterior to government property. That being said, 
high emphasis is placed on maintaining a policy of not 
exposing the general public to “a risk level greater than 
the background risk in comparable involuntary 
activities.” [1] Most range commanders, by 
requirement, can only accept risks above established 
baselines on the basis of national need. [2] The process 
associated with completing Environmental Assessments 
may solicit public opinion on the risks associated with 
range operations. 

In addition to the safety requirements developed and 
implemented by the ranges, some range users, such as 
NASA, have developed and implemented independent 
range safety requirements, and associated processes for 
acceptance of public safety risk. These processes are 
considered in addition to range processes and do not 
substitute for or remove any authority from the range or 
decision maker. All parties must be “GO” for a launch 
to proceed. 

2.1. Divulging the risk numbers 

The communication of risk can prove to be complicated 
and difficult, but is considered a very important, if not 
the most important step of the risk management process. 
Communicating risk numbers requires mastering many 
elements, including the presentation of quantitative 
results compared to established criteria, understanding 
and explaining the uncertainty associated with the 
quantitative results, and addressing issues of particular 
concern to the decision maker. 


Most ranges follow a similar process for risk 
communication. When a range user approaches the 
range with a specific concept or design to be tested or 
launched, the range responds with a statement of 
capability, essentially clearing the way for more detailed 
technical discussions. Range Safety and the range user 
then start a detailed tailoring process to identify agreed 
upon safety requirements and to identify potentially 
equivalent ways to meet requirements. When this 
process is complete, the set of tailored requirements is 
presented to the decision maker. The decision maker is 
responsible for accepting or disapproving any identified 
design or process that deviates from the baseline 
requirements and that may result in elevated range 
safety risk. 

Following acceptance, the range user is responsible for 
implementing and complying with all tailored 
requirements. If deviations or exceptions are realized 
during the operations processing phase, the user may 
request a waiver to a specific requirement. The request 
contains justification to continue the operation with the 
identified deficiency and usually includes a get well 
plan and statements addressing the perceived increase in 
risk above baseline (residual risk) if any. The range 
safety office is then responsible to review the waiver 
request, perform a risk assessment, and provide a 
recommendation to the decision maker. It is then up to 
the decision maker to accept the residual risk, request 
additional mitigation efforts, or disapprove the waiver 
request. 

2.1.1. “We are the safety professionals; don’t say 
anything.” 

Balancing the amount of communication provided to the 
decision maker and those potentially hazarded by the 
risk can prove difficult. To determine the adequacy of a 
launch vehicle from a safety perspective, analysts 
routinely compare analyses results to documented 
standards or criteria. When common practices result in 
unfavorable results, a safety analyst may review the 
process and modify assumptions deemed overly 
conservative. The analyst then has to decide whether 
the change to standard practice should be presented to 
the decision maker. Many factors play into this 
decision; “How much more effort will be required to 
properly explain the process?”, “Will the decision 
maker understand what I am trying to convey?”, “Will a 
presentation in front of a large audience be required?”, 
“Will an opposing view be presented?” and the list goes 
on. As can be seen, it is usually easier for the analyst to 
document the theory or assumption and move on 
without communicating the process change. Although 
usually done in good conscience, analysts may fail to 
communicate changes in process to the proper authority 
levels. 
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Liability must also be considered when deciding what is 
presented to the decision maker. The “informed 
decision” principle is used in tort claims against the US 
government, protecting officials from court system 
second-guessing in determining the acceptability of 
operational risks. However, a key test under this 
protection requires the decision maker to be fully 
advised and informed of the known risks. Failure to do 
so can result in increased liability of the U.S. 
government and/or the decision maker. 

A way to foster proper communication habits within the 
organization is to create an environment of trust and 
open communication. Management sometimes 
overlooks the pressures realized by some analysts when 
having to present technically challenging ideas or 
differing opinions to groups or higher levels of 
authority. Managers should ensure they are 
approachable when potentially contentious issues arise. 

2.1.2. “Communicate maximum individual risk 
allowable to range users selectively” 

In the early development phases of the U.S. ranges, non 
disclosure of criteria used to determine launch vehicle 
safety adequacy was common. Without a clear 
understanding of minimum requirements, some safety 
offices believed range users would develop safer, less 
risky systems by not designing to a minimum set of 
standards. By not communicating “acceptable” criteria, 
they believed range users were more prone to design to 
a reasonable or higher level of safety. Ranges also 
believed this practice provided them with an advantage 
when requesting or requiring design changes or 
additional hazard mitigation, because an argument could 
not be made by the range user concerning compliance 
with minimum design standards. This practice often led 
to expensive and time consuming re-designs, frustrated 
range users, and the very subjective, inconsistent 
approach to launch safety approval. 


processes and acceptable risk criteria. Current policy at 
most ranges require either the launch user or the range 
to calculate collective and individual risk from hazards 
associated with the operation, and compare the results to 
acceptable criteria. Prior to starting the operation, all 
residual risk is presented and either accepted or 
disapproved by the decision maker. If risk is above 
acceptable criteria, the project team will first attempt to 
reduce risk below acceptable levels, but may ultimately 
request a waiver from the regulating authority. 



Figure I. RCC 321 Criteria 


An alarming trend surfacing within some of the range 
safety community is the justification of a failed test or 
lack of a specific safety system based purely on a 
calculated risk number. Two methods have 
traditionally been used concurrently to limit public 
safety risk; the use of a highly reliable range safety 
system (commonly referred to as a Flight Termination 
System (FTS)), and a flight safety analysis to ensure 
calculated risks are within acceptable criteria. Initial 
emphasis has always been on hazard containment and 
control. Risk analysis, with its many modeling and data 
uncertainties, is used to provide assurance that the risk 
is small and the primary controls are adequate. The 
evaluation of launch vehicle safety should always be 
based on both of these principles. 


Today, due to a number of factors, ranges have 
accepted, and found benefit in policy that requires the 
full disclosure of acceptable risk criteria and a set of 
minimum design requirements. Both the range and 
range user benefit from such a set of safety design and 
acceptable risk requirements. The range is able to 
enforce fair, consistent, defendable requirements while 
the range user has an upfront understanding of design 
expectations, making the approval process more 
streamlined and cost effective. 

2.1.3. Collective and individual risk policy 

Many local range safety requirement documents contain 
acceptable criteria for both collective and individual 
risk. Most of the documents develop acceptable criteria 
based on RCC-321[1] (See Fig. 1), which defines 
consensus standards for range risk management 


2.1.4. The Carnegie Mellon study 

Fischhoff [3] describes four types of specialists needed 

for effective communication within organizations. They 

include: 

1. Subject matter specialists, who can identify the 
processes creating, and controlling risks (and 
benefits). 

2. Risk and decision analysts, who can estimate the 
risks (and benefits) most pertinent to decision 
makers (based on subject matter specialists’ 
knowledge) 

3. Behavioral scientists, who can assess decision 
makers’ beliefs and goals, guide the formulation of 
communications, and evaluate their success. 

4. Communication practitioners, who can manage 
communications products and channels, getting 
messages to audiences and feedback in return. 
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Applying creative license, one may observe the ranges 
applying this philosophy in their own way, but with 
potentially serious limitations. In the case of the DoD 
ranges, the decision maker is considered to be the 
Commander, so the need for behavior scientists and 
communication practitioners are different, and may 
even be diminished. However, like many other 
organizations, subject matter experts and risk analysts 
develop and deliver presentations to the decision maker 
based on technical information and, although usually 
innocent, a potentially narrow view of the issue. In 
addition, these individuals may or may not understand 
the issues important to the decision maker and 
sometimes use the presentation to advance or advertise a 
certain agenda. 

Fischhoff suggests the following when trying to 
determine what to convey: 

1 Complete mental models, by bridging the saps 
between expert and lav mental models . That could 
mean adding missing concepts, correcting mistakes, 
strengthening correct beliefs, and de-emphasizing 
peripheral ones. 

2. Ensure appropriate confidence in beliefs , The most 
dangerous beliefs are those held with too great or too 
little confidence. The appropriateness of confidence can 
be assessed by comparing judged probabilities of being 
correct with actual ones. Then focus communication on 
cases where overconfidence could cause poor choices or 
under-confidence could prevent sound ones. Routinely 
communicating how well facts are known might 
improve the appropriateness of recipients’ confidence. 

3. Provide information in order of its expected impact 
on decisions . Value-of-information analysis determines 
a fact’s expected contribution to decision outcomes. 
Although nothing should be hidden, communications 
should get these few facts across. 

3. COOPERATION AND CONFRONTATION 

Space lift operations can pose a threat during prelaunch 
processing, launch and ascent to orbit and return from 
orbit or space. Return from orbit is further divided into 
random re-entry, planned controlled re-entry and 
planned uncontrolled re-entry. Random re-entry can 
place any location at risk within the overflown latitudes. 
Planned re-entries affect more confined regions; 
planned controlled re-entries can direct hazards away 
from populations and valuable assets. Random re- 
entries for larger objects transform, as an orbit decays 
and the objects are more closely tracked, into a more 
planned, but possibly uncontrollable re-entry. . The 
international track record varies significantly among 
these phases of operation. 


3.1. Launch and Ascent 

An important consideration in siting a launch complex 
is adequate control of surrounding lands to minimize 
current risks to the public from processing and launch 
operations, and to manage foreseeable future risks. 
Support from the surrounding communities and their 
government is a key to implementation. Outside of the 
immediate launch area, management of risks by 
controlling land use is more difficult. 

In the early 1990’s, the State of Hawaii invested 
substantial sums of money for planning and 
environmental studies to support a proposed 
development of a Palima Point Space Launch Complex. 
The launch site was shown to be versatile, capable of 
supporting missions ranging from near equatorial orbits 
through polar orbits and accommodating launch 
vehicles with a heavy lift capacity (Delta II). The high 
quality technical planning did not offset the failure to 
involve the local population. Without any recognition 
of local benefits, stories in the local paper about the 
potential for catastrophic toxic spills outside the local 
cafe quickly put an end to this project. 

Contrast this experience with Spaceport America in 
New Mexico. This inland facility spent many years 
developing a broad support base from the local towns 
up through the state government. Enthusiasm for the 
effort is directly related to the expectation of long term 
economic benefits to the region. 

Vandenberg Air Force Base supports polar 
inclination/orbit space lift operations. Ranchers 
occupying in holdings within the base consider it an 
opportunity to show their patriotic support for their 
country by leaving their homes during potentially 
hazardous operations. 

The Baikonur Cosmodrome was built during the Soviet 
rule. Later with the breakup of the USSR, Russia 
signed an agreement with Kazakhstan to rent the 
facilities until 2050. The rental fee has been a 
continuing source of dispute between Russia and 
Kazakhstan. 

Thus, it should be no surprise that when there were a 
series of launch failures of the Proton launch vehicle, 
Kazakhstan was sensitive to the Russian response to the 
failures. In July 1999, after failure of a Proton launcher, 
a 200 kg segment fell into the backyard of a villager on 
the steppe of the northern Kazakh region of 
Karkaralinsk. BBC reported that the Kazkh government 
was angry with Russia [4], In October of that same 
year, after a similar explosion, Russia responded 
promptly to the Kazakh prime minister’s request to 
assess the potential for environmental damage and to 
compensate Kazakhstan for any environmental 
damages. This prompt response resulted an expression 
of satisfaction by the Kazakh government [5]. 
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3.2. Re-entry 

Truly random re-entry affords minimal risk 
management opportunities. At the design stage, 
engineers can. consider the potential impact of 
promoting re-entry thermal demise. Moreover, there is 
a growing literature that addresses these risks. 

The uncontrolled re-entry of large objects, such as 
boosters and spacecraft, hazard relatively broad, but 
more well-defined regions. Objects of concern range 
from large, well-publicized spacecraft, such as the 
Hubble Space Telescope and the Russian Mir Space 
Station, to more covert spacecraft such as the Russian 
RORSAT COSMOS satellites. Key elements that have 
occurred in response to uncontrolled re-entries have 
typically been detection, tracking and narrowing the 
region hazarded, verification of key facts with the 
spacecraft owner, development of emergency response 
plan, and emergency response communication. 

As the Mir Space Station approached the end of its life, 
the Russian Space Agency was able to focus their re- 
entry calculations. They planned to initiate re-entry 
with a series of braking maneuvers designed to produce 
a splashdown in an area of the Pacific midway between 
New Zealand and Chile. Nevertheless, the Russians 
provided advance planning and coordination 
information to nations that could potentially be affected 
from their Ministry of Foreign Affairs and their 
Aviation and Space Agency. Australia was notified as 
part of the communication of the remote possibility of 
Mir debris impacting on Australia. Australia developed 
an information tracking system, a Mir National Warning 
Group, and established the ground work for activating 
the Commonwealth Government Disaster Response 
Plan in case of on land debris impacts. Warnings were 
posted to pilots and mariners of areas expected to be 
hazarded. Finally, press briefings were issued by the 
Australian Emergency Management Agency. The 
potentially affected public was, thus, well-informed, 
even though ultimately on March 23, 2001 the Mir 
debris impacted, as expected, in the ocean [6]. 

The Mir success provided a contrast to earlier re-entries 
taking advantage of its controlled re-entry and using 
early and continued dissemination of planning 
information to the international community. In July 
1979, Skylab re-entered showering the area southeast of 
Perth, Australia with pieces of debris [7]. No one was 
injured nor was there property damage. Although 
NASA had originally planned to retrieve Skylab in the 
Space Shuttle’s cargo bay or to boost it to higher orbit, 
these solutions were not available in time to support this 
approach. The situation was aggravated by the 
increased atmospheric drag from the approaching solar 
maximum. NASA engaged in a number of ingenious 
approaches in an attempt to maintain Skylab in orbit 
long enough for it to be rescued. Ultimately, it became 


apparent that rescue was impossible. NASA initiated a 
coordinated effort involving key NASA centers, the 
FAA, NORAD, and the U.S. State and Defense 
Departments to coordinate re-entry predictions, risk 
predictions, dissemination of information and 
emergency preparedness. Major challenges involved 
drag uncertainty and uncertainty in the progressive 
breakup of the cluster. 

Much of the media attention focussed on the Skylab 
arose in reaction to the January 24, 1978 uncontrolled 
re-entry of the Russian RORSAT Cosmos 954. In late 
1977, U.S. tracking radars reportedly observed an 
unusual decay of the Cosmos 954 orbit. The U.S. 
formed an interagency team to evaluate the situation and 
develop an appropriate contingency plan. 
Implementation was complicated by the need to confirm 
with the Soviets information regarding their surveillance 
satellite. After it was confirmed that the satellite 
contained a small reactor for its payload, the U.S. began 
to prepare for its re-entry [8], [9]. This included 
communication with other nations, the U.S. Congress, 
and the Federal Preparedness Agency. After the 
satellite crashed in the Northwest Territories, Canada, a 
joint American-Canadian team surveyed the area, some 
48,000 square miles, by foot and by air in an attempt to 
recover radioactive material. The Canadian 
Government billed the Soviet Union for over $6 million 
for expenses and future unpredicted expenses. The 
Soviet Union eventually paid Canada $3 million in 
settlement [10]. 

At 8:00 A.M. on February 1, 2003 the NASA Mission 
Control Center, having completed their safety checklist 
review, determined that the Space Shuttle Orbiter, 
Columbia , was “GO” for de-orbit bum leading to a 
planned controlled re-entry. The Columbia Accident 
Investigation Board reconstructed both the train of 
observables and characteristics of the accident [11]. 
Among the earliest signs of Columbia’s shedding debris 
were noticeable bright streaks in Columbia's 
luminescent trail beginning sometime after crossing the 
California coast. Nevertheless, it was not until shortly 
after the scheduled landing in Florida approximately 
9:15 EST that NASA, recognizing that Columbia had 
been destroyed during re-entry, and that there were no 
survivors, initiated its Contingency Action Plan. NASA 
immediately initiated warnings to the public of the 
hazards associated with certain pieces of debris from 
toxic and explosive materials, and initiated a massive 
search plan to identify impact locations and safely 
recover the debris. No one was injured by the falling 
debris and property damage was minimal, largely 
because of the low population density in the impact 
area. 

In none of these cases, were the risks assumed with 
consent of those on whom they were imposed. The 
uncontrolled re-entry risks demonstrated a need for an 
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evolution in risk communication and emergency 
response. The Columbia controlled re-entry failure 
brought about several major changes in the U.S. NASA 
developed and disseminated a public risk acceptability 
policy for launch and re-entry of space vehicles. [12] To 
support implementation of these policies, NASA has 
directly and, through its contractors, developed tools for 
quantifying third party risks. The FAA has recognized 
the need to clear the air space volume potentially 
affected by a failing returning spacecraft and, with 
coordination from NASA, has initiated a program to 
divert traffic from the hazard area in the case of an 
accident. 

4. INTERNATIONAL ISSUES 

The previous anecdotes illustrate several evolving issues 
associated with the growing numbers of space faring 
nations and launches. The issues arise from the needs 
for informed consent of those assuming the risk and 
mechanisms to communicate and manage hazards in an 
emergency. Important elements include risk 
assessment, risk communication, risk management, risk 
acceptance, and emergency preparedness and response. 
How these issues need to be approached is directly 
related to the reliability of space lift vehicles. For the 
foreseeable future, it is reasonable to assume that launch 
vehicle improvements may significantly enhance overall 
performance and reduce the cost of access to space. 
However, partially due to the limited number of 
launches, these improvements are not expected to have 
a significant affect on reliability. It is assumed the level 
of reliability associated with commercial aircraft will 
not be soon achieved. This will result in a growing 
number of launches, re-entries and over flights of 
foreign territory by low reliability boosters. 

The nature of the response required for these issues 
varies with risk levels, number of involved participants, 
and the associated political relationships. Launch area 
risks usually are the most well-defined, involving, at 
most, the launching nation and the host nation usually 
placing relatively small numbers of people at risk. 
Although hazard areas associated with a full 
malfunctioning space booster are larger than those from 
an upper stage, the relative predictability of the area that 
may be affected, and its modest geographical extent 
facilitate risk management. Frequently, the region in 
the launch area is within the jurisdiction of the 
launching country. When this is so, it renders the 
compliance with local regulations and interagency 
cooperation easier. Increasingly, however, the 
launching nation and the launch site are not the same. 
Russia has faced this situation with their Baikonur 
Cosmodrome and both Russia and other European 
nations face that situation with launches from Kourou. 

As a space booster proceeds downrange and increases 
speed, small changes in the velocity vector result in 


large changes in the location of areas hazarded by a 
malfunction, increasing the region potentially hazarded 
by a failure and the number of people potentially at risk. 
This is somewhat offset, from a risk management 
perspective, by the smaller casualty area (area in which 
people of property may be hazarded) associated with the 
failed vehicle, the increased time between an accident, 
and the time people or assets are at risk. Similar factors 
apply for downrange over flight and over flight during 
re-entry. 

Informed consent and emergency preparedness are 
considerations throughout flight from launch to re-entry. 
The extended launch area will likely involve citizens of 
the launching states and the host state. With a single 
launching agency, the processes and procedures for 
quantifying risks may be expected to be internally 
consistent. The challenge will be working with 
emergency preparedness agencies, local governments, 
and, as required, addressing the bilateral agreements 
needed when the launching nation and the host nation 
are different. 

With multiple launching agencies or multiple launching 
nations, the problem becomes more complex. Each is 
likely to have its own procedures for quantifying and 
managing risks. Each is, moreover, likely to regard 
significant aspects of this process in a proprietary 
manner creating challenges for assessing the annual 
risks to those in the launch area and to structuring 
appropriate emergency response processes. 

Outside of the immediate launch area, the situation 
becomes more complex. Risk communication is 
complicated by the larger area at risk from any accident, 
by the involvement of multiple nations, and contribution 
of multiple launch sites, agencies, and launching nations 
to the annual risk. Fig. 2 shows an example of the large 
downrange region potentially influenced by two U.S. 
launch sites. Typically, risk contributors in the 
downrange region and for re-entry extend to include 
multiple agencies, launch sites, and launching nations 
complicating issues of annual risk assessment, risk 
management and risk communication. An example of 
the added complications is the challenge of protecting 
ships and aircraft over international waters. Publishing 
warning notices to either ships or aircraft over broad 
ocean areas is of limited effectiveness without 
surveillance. 

Surveillance on large areas, distant from land is costly. 
Currently, limited systems are in place to divert aircraft 
or ships after an accident. Neither is there any 
international system in place to respond when a 
launching nation recognizes that danger is imminent. 
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Figure 2. Over flight from multiple ranges 


5. PROTOTYPE APPROACH 

The following concepts illustrate two innovations that 
may be more broadly applicable to address the issues of 
informed consent by risk takers and emergency 
preparedness by space faring nations. 

5.1. ER and Brevard County Emergency Response 
Partnership 

The relationship between the Eastern Range Safety 
Office and The Brevard County Office of Emergency 
Management can be seen as an example of a successful 
risk communication/mitigation partnership. Although 
not directly involved with launch risk decision process 
for the reasons discussed in Section 2, Brevard County 
takes an active role in working with the range safety 
office in establishing proactive mitigation techniques 
implemented in the event of a launch accident. 

On a yearly basis, the range safety office meets with the 
Brevard County Emergency Management personnel, 
and discusses new launch vehicles, hazard mitigation, 
and response actions. These discussions provide first 
responders with the knowledge required to react to such 
emergencies. It also provides insight into the launch 
business and presents, credible, although highly 
unlikely, scenarios to the responders. This 
communication is very helpful to both organizations in 
that it provides a forum to discuss actual events and not 
rely on “standard” emergency protocols for response. 

During the launch count down, the county activates the 
Brevard Emergency Operations Center (BEOC and 
provides a representative to the Morrell Operations 
Center (MOC). The MOC serves as the Eastern Range 
control center for launches. The county representative 
is provided a console adjacent to the risk analysts and 
provides real-time information to the BEOC in 
preparation for emergency response. 

5.1.1. Reverse 911 

A very useful tool being implemented at some ranges is 
the reverse 911 system. The Eastern Range (ER) and 
The Brevard County Office of Emergency Management 
have implemented such a system to help mitigate 
hazards associated with a launch anomaly. As provided 


real time during a launch, the ER Toxic Risk Engineer 
(TRE) advises the county representative of potential 
worst case toxic plumes that may result in the event of a 
launch anomaly. If the event occurs, the county is ready 
to activate the reverse 911 system with pre recorded 
announcements advising the public of the accident and 
what sheltering or mitigation actions to take. As real 
time updates are received, the areas being called can be 
quickly changed with different instructions, if 
appropriate. The system provides the ability to contact 
every household (with wired telephone service) within 
the area the operator selects on a common GIS map 
computer screen. The system can also be used for 
advising the populace on a variety of other launch 
related hazards and weather conditions (tornadoes, 
flooding, etc) and potential criminal activity 
(kidnapping alerts etc) and provides an outstanding 
service to the community. Implementation of such a 
system provides a powerful communication tool and has 
been proven to be very useful part of an overall launch 
hazard mitigation process. 

5.2. Spaceflight Management Program 

A detailed aircraft risk analysis, funded by the FAA, 
used the records of aircraft activity at the time of the 
Columbia accident, and found that the probability of an 
impact by Columbia debris to commercial aircraft in the 
vicinity was at least one in a thousand, and the chance 
of an impact to general aviation was at least one in a 
hundred. [13] After FAA executives were briefed 
about the potential for aircraft impacts during the 
Columbia accident the FAA began to investigate a 
decision support tool to better manage the interface of 
space and air traffic in the future. The FAA has 
initiated the Spaceflight Management Program (SMP) to 
better coordinate space vehicle operations with air 
traffic. As part of the SMP, tools and procedures are 
being developed to prepare for and then mitigate the 
risks to aircraft from space vehicle accidents. These 
tools will provide air traffic managers situational 
awareness of space traffic in a routine manner. In 
addition, in real time, if there is an accident, one tool 
will compute the air space hazarded by debris using 
models of breakup and real-time data from the space 
vehicle. The resulting information will be forwarded to 
the FAA's Enhanced Traffic Management System 
(ETMS) as Traffic Flow Management (TFM) areas, 
which initiate the process of air traffic controllers 
directing aircraft away from the hazard in the time 
between the accident and the time the debris falls to 
aircraft altitudes. [14] SMP would treat the potential 
debris hazard like an area of severe weather, and would 
provide conflict advisories and recommend routes to 
safely and efficiently direct aircraft around the hazard 
area. 
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6. IMPLICATIONS FOR THE 

INTERNATIONAL SPACE COMMUNITY 

A prerequisite for informed consent is a consistent 
means of quantifying and expressing risk from launch 
and re-entry operations. Presentations at both the first 
and the second IAASS conferences demonstrated the 
diversity of risk quantification methods, risk measures, 
and risk acceptability standards employed by space 
faring nations. The U.S. FAA has drafted standards 
addressing these issues. One approach to 
standardization would be to use the FAA effort as the 
point of departure for a working group including the 
major international space agencies. These previous 
efforts will provide a foundation for characterizing 
sound methodologies for quantifying mission risks. 

It will then be necessary for the group to shift their 
perspective from that of a space faring nation to that of 
a risk taking nation. Measures and procedures will need 
to be formulated from the existing processes to translate 
the risks into measures meaningful to those assuming 
the risks, such as maximum annual individual risk or 
annual societal risk. The societal risk measures will 
need to define appropriate geographical regions for 
aggregating risks. One might assume that societal risk 
need only addressed at the level of affected nations. 
This would, however, lead to the anomaly that it might 
be acceptable to subject several small nations to a level 
of risk that would be rejected if imposed on a large 
nation of their combined geographical area. 

Other important administrative issues that must be 
addressed in such a system include 

• Defining a system and agency to track risk reporting 
for completeness and consistency 

• Development of a dissemination plan defining the 
organizations who should be the recipients of the 
risk computations and what information each should 
receive 

• Defining processes and procedures to address 
obtaining national risk acceptance by affected 
nations 

• Defining processes to address risk mitigations when 
the risk to some region is excessive. This may be 
particularly challenging since the risk may result 
from multiple launches from different launch sites 

The second major gap is a system for emergency 
preparedness, notification and response to booster 
malfunctions and malfunctions of returning spacecraft. 

• Notification and response time may be extremely 
limited. The available time must be used to identify 
and evaluate the potential hazard, to notify aircraft 
and ships to avoid the expected hazard zone, to 
develop and disseminate public advisories for 
sheltering, and to mobilize post disaster response. 
Thus, a high priority is the development of an 
emergency response plan. Space faring nations 


should develop a means of sharing “lessons learned” 
defining effective plans. 

• Implementation : International protocols need to be 
developed for effectively communicating hazard 
areas in international waters and airspace. 
Cooperative agreements are needed to overcome the 
difficulties in patrolling waters and airspace at a 
large distance from land. 
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2007: IAASS Working Group proposed four goals 
for Space Safety. 

The first was to: 



It is understood that protection should address all hazardous mechanisms 
from normal flights and malfunctions. 
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Have we achieved the goal already? 

What progress have we made? 

What issues must be addressed? 

Recommendations to the Space Faring 
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Have we achieved the goal already? 

What progress have we made? 

What issues must be addressed? 
Recommendations to the Space Faring Community 



Checklist: Achieved the Goal? 

“Unreasonableness” is a matter of perception. Risk 
takers must be part of the process. 

We need to speak the “same language” when talking 
about risk. 

- What level (s) of injury and damage do we mean? 

• (fatality, casualties, severe injuries, minor injuries, etc.) 

- What are our measure (s) of risk? 

• (maximum individual risk, collective risk / societal risk, catastrophic 
risk, impacts to critical assets) 

- What threats must be addressed? 

• Planned and malfunctions 

• Inert debris, explosions, fire, toxics 

We need methods to consistently quantify risk and 
aggregate the risk over all launches, launch sites, and 
launching nations. 
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Have we achieved the goal already? 
What progress have we made? 

What happens if we do not? 

What issues must be addressed? 

Recommendations to the Space Faring 
Community 



We’ve made some progress! 
(but have a long way to go): 

As a community, space faring nations have made some 

progress: 

- Through the IAASS and other platforms we are 

• Sharing our methods for quantifying launch and reentry risk 

• Sharing our risk management methods 

• Sharing our standards for acceptable risk 

- In the USA, we have been developing consensus standards for 
risk quantification and risk acceptability among our ranges. 

- ESA and the USA have made initial steps to exploring each 
other’s risk quantification and risk acceptability standards. 

- We have begun asking the critical questions to identify present 
and future issues. 



RCC 321-07 Achievements 

U.S. acceptable risk guidelines for launch by launch 

- Societal risk 

- Individual risk 

- Protection of ships and aircraft 

Rationale for acceptable risk criteria 
Hazard thresholds 

Guidance for modeling launch risks from 

- Inert and explosive debris 

- Toxic exhaust and combustion products 

- Distant focusing overpressure 

- Radiation hazards 



Risk Communications 

The launch authority and his safety representatives 

- Evaluate the risk 

- Launch authority: National need -- accept above baseline risks 

Communication of acceptable levels of risk 

- General policy is public: RCC 321-07 

- Major evolution from early policy of non-disclosure of acceptable 
levels outside of range safety offices 

Evolving issues 

- Published acceptability levels encourage launch agencies to 
“push the envelope” instead of minimizing risk 

- When and what to communicate of risk analyses of particular 
missions 
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What issues must be addressed? 







Some challenges 


Launch acceptability is typically treated 
on a per launch basis. 

Risk acceptability is generally understood 

on an annual basis. 

Multiple launch sites from different 
nations can hazard the same areas. 

Risk acceptability is linked to perceived 
benefits and choice. Perceived benefits 
from different launches will vary; choices 
may depend on relationships between the 
launching nation and the over flown 
nation. 





How should allowable risks be allocated 
back to the space faring nations? 

Implementation and monitoring? 
Emergency preparedness and response 



Involvement, Risk Communication, 

and Acceptance 

• In the US, failure to obtain 
timely involvement of the 
public resulted in the 
demise of the proposed 
Hawaiian Spaceport. 

* Spaceport America is 
enthusiastically supported 
by its neighbors. 






SE Hawai ' i 


New Mexico Spaceport 
Authority officials 
announced a successful 
launch of a test flight vehicle 
Read More 

in Doha Ana County 
Commissioners approved a 
contract setting up a 
spaceport tax district Read 
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In a statement on local TV, picked up by BBC Monitoring, the 
Kazakh government was said to be angry with Russia 
because of the accident. The Khabar TV presenter said the 
ban on further launches would stay in place “until all issues 
related to the catastrophe are investigated and the material 
damages inflicted on Kazakhstan are established " 

ISS service module 

Part of the Proton launcher, weighing some 200 kilograms 
(440 lbs), fell into the backyard of a villager on the steppe of 
the northern Kazakh region of Karkaralinsk. 
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The next phase of the multi- billion-dollar lnt< 
(ISS) hangs on the outcome of an investigate 
Proton-K rocket failure at the Baikonur Cosmc 
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communications satel 
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There were no victims, 
although a woman and her 
son were at home when the 
rocket part fell from the sky, the 
TV said. 


Baikonur was established 
during the time of the 
Soviet Union. Following 
its breakup, Russia and 
Kazakhstan negotiated 
terms for the use of the 
facility. 

Nevertheless, the need for 
on-going balance between 
the risk takers and the 
Russian space program 
offers challenges. 
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Cosmos 954 




From Wikipedia, the free encyclopedia 
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Re-entry 


Re-entry risks are particularly 
challenging. 

The communications and 
emergency response issues 
are magnified yvhen it is an 
uncontrolled re-entry. 


and aii - until the spring ice 
impractical. They were ultimately able 
to recover 12 larger pieces of the satellite. These pieces displayed radioactivity 
of up to 1 . 1 sieverts per hour, yet they only comprised an estunated 1% of the 
fuel. For these recovery efforts, the Canadian Government billed the Soviet 
Union $6.041. 174.70 for actual expenses and additional compensation for 
future unpreclicted expenses: the U.S.S.R. eventually paid the sum of 3 million 
dollars. 





Emergency Management Australia Update on Re-entry of Russian Mir Space Station 
03 - 16-2001 



STATUS REPORT 
Date Released: Friday 

Source: Emergency Ms 


Emergency Management Austr 
Territory 

MEDIA ENQUIRIES 

Brian Flanagan 
EMA Media Liaison 
Mobile: 0409 489 344 


On current indications fro 
Station is predicted to s\ 
New Zealand and Chile, ad 


i MIR Re-entry 


2.4km per day. While this 

Mir will be brought back ir 
reaches an altitude of 22C 


MIR: ROUTE OF DESCENT 


Mir re-entered Earth atmosphere 


Remains of Mir 
landed here 


Flight path of Mir 
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preparedness. 


NASA and ESA are following the flight of Mir and information gathered is being passed to Russian Mi 

Two officers from the Australian Embassy in Moscow will be in the Space Centre during re-entry and 
real-time information to EMA on the progress of the operation. 

EMA will continue to issue updates on the re-entry process and will advise arrangements being put in 
briefings around 21-22 March. 





Summary of Key Issues 

Informed Consent 

- Common measures of risk 

✓ « ^ l 

- Agreement on “Baseline” Risk 

- Consistent risk assessment methods 

- Protocols for aggregating risks 

- Protocols and institutions to receive risk information to represent 
their constituencies 


Summary of Key Issues 

Emergency Planning, Preparation, Communication & 
Response 

- Launch area international exposure 

• Who: 

- Launching nation and host nation different 

- Shipping lanes 

- Airways 

• Affected parties need 

- Information on risk characteristics 

- Notification/Acceptance by populations exposed to risk 
above baseline 

- Pre-planned response given a disaster 

- Notification of a disaster 


Summary of Key Issues 

Emergency Planning, Preparation, Communication & Response 

- Down range international exposure 

• Who: 

- Land: typically, all foreign 

- Shipping lanes 

- Airways 

• Affected parties need 

- Mobile 

» Surveillance and vector to safety 

- Land 

» Response advise and assistance 

- Notification/Acceptance by countries exposed to risk above 
baseline 


Future Concerns 


It is foreseeable at some time a space booster will fail 
late in flight. The consequences may be debris 
impacting on foreign soil, possible impacts to sea lanes, 
and possible impacts to air corridors. 

The impact of that accident on future space flight and 
international relationships will be affected by how well we 
lay the ground work to 

- Involve parties at risk in understanding and accepting the 
elevated risks, recognizing that there are precedents with aircraft 
over flight and other technologies and 

- Implement emergency response procedures to manage the 
consequence of the accident. 
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Have we achieved the goal already? 

What progress have we made? 

What issues must be addressed? 

Recommendations to the Space 
Faring Community 



Risk Communication 


• FAA Standards 

• RCC 321 Guidance 

• ESA guidance? 

• Other contributors? 
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Risk Analysis 
Standards 



Annual 

Risk 

Measures 




• Treaty / protocol for acceptance 

• Acknowledgement and Acceptance of Excessive risk 

• Negotiating mitigation with launching states 


• Pr {Casualty producing accident) 

• Pr (Accident with > $X/National Asset) 

• Annual Collective (Societal Risk) 

• Other? 



Emergency Management 


Standard 

Emergency 

Planning 

Scenarios 



Requirements 

Emergency Responders 
Content 
Launch Safety 



Communications 

Protocols 


• Ships and Aircraft 

Surveillance 

Spaceflight Management Program 
Vector to Safety 

• Land based populations 

Involve Emergency First Responders 
Reverse 9 1 1 


Emergency 

Response 

Plans 

• Warning 

• Consequence Limitation 

• Relief 



Lessons 

Learned 


